5 ms·

You guys should take this much more seriously. This blog post has a tone of "much ado about nothing". This is a very serious exploit. Combined w vulnerabilitie

by qeorge 14y ago

You guys should take this much more seriously. This blog post has a tone of "much ado about nothing". This is a very serious exploit. Combined w vulnerabilities in other unsecure but popular plugins[1], this exploit is as damaging as one can possibly be. I have a feeling I'll be cleaning up after this one for a long time (we're still having to clean up hacked sites from timthumb). Look, mistakes get made. But you need to own up to it, and be honest about the size of the problem. In particular, I find these passages disingenuous: "Rest assured there is no link and the exploit was actually fixed a few days before our website was hacked." (in bold) Given that the exploit was live, on your server, this is misleading at best. Yes, you had found the bug and committed it on 4/23. But obviously it hadn't made its way to active WooThemes installations, including your own. In your repo != fixed. "The potential exploit is such that the shortcode preview allowed users to generate shortcodes using the preview window’s file, without authenticating the user." More accurate would be: "the exploit allows anyone off the street to run any shortcode from any plugin you have installed. Vulnerabilities that were limited to logged in users before are now available to bots." The OP should have been more responsible in his disclosure. But so should have WooThemes. Nothing in your public communications reflects the seriousness of this exploit. For what its worth, you just lost (at least) one customer. [1] http://secunia.com/advisories/46227/ http://secunia.com/advisories/46227/

mattyza 14y ago
qeorge, We can assure you that we are aware of the nature of this possible exploit. Security is of paramount importance to us. The wording on our blog post is such to make known the severity of the possible exploit, while also being sure to ensure our customers that the possible exploit has been patched successfully. To ensure that we communicate as effectively as possible to as many audiences as possible in possible future exploits, we've setup a new development-specific channel on Twitter and will be making other avenues of communication open to ensure that we inform our customers of security updates as quickly as possible.

by qeorge 14y ago

mattyza 14y ago

qeorge, We can assure you that we are aware of the nature of this possible exploit. Security is of paramount importance to us. The wording on our blog post is such to make known the severity of the possible exploit, while also being sure to ensure our customers that the possible exploit has been patched successfully. To ensure that we communicate as effectively as possible to as many audiences as possible in possible future exploits, we've setup a new development-specific channel on Twitter and will be making other avenues of communication open to ensure that we inform our customers of security updates as quickly as possible.